Formal TSP Model
¨ The TSP model shall be formal
¨ “Where the functional specification is
at least semiformal, the demonstration of
correspondence between the TSP Model
and the functional specification shall be
semiformal”
¨ Where the functional specification is
formal, the proof of correspondence
between the TSP Model and the
functional specification shall be formal
600.436 High-
Assurance Systems
Fall 01/Protection Profiles
24